#!/usr/bin/python3 # Code by PosiX from urllib.request import Request, urlopen from urllib.error import URLError, HTTPError import argparse import sys import time global starttime class ZeroScann(): def __init__(self): self.scan() def scan(self): # argument parser like shit parser = argparse.ArgumentParser(prog="PosiX.py", description="Simple Find Shell in Website") parser.add_argument("-u", dest="domain", help="your url") parser.add_argument("-w", dest="wordlist", help="your wordlsit") args = parser.parse_args() if not args.domain: sys.exit("\033[36musage: shell.py -u example.com -w wordlist.txt") if not args.wordlist: sys.exit("\033[36musage: shell.py -u example.com -w wordlist.txt") # handle url website format site = args.domain print("\033[96m[?] \033[0mStart Crawling...") print("\033[96m[!] \033[0mWait a sec!","\n") time.sleep(3) if not site.startswith("http://"): site = "http://"+site if not site.endswith("/"): site = site+"/" # load wordlist try: pathlist = args.wordlist wlist = open(pathlist, "r") wordlist = wlist.readlines() except FileNotFound as e: print("\033[91mUpss, Wordlist Not Found!\033[0m") exit() finally: try: wlist.close() except: print("\033[91mWordlist Can\'t Close!\033[0m") # user-agent user_agent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36" #list to hold the results we find found = [] # respon code resp_codes = {403 : "403 forbidden", 401 : "401 unauthorized"} # loop with join pathlist starttime = time.time() for psx in wordlist: try: psx = psx.replace("\n", "") url = site+psx req = Request(url, headers={"User-Agent": user_agent}) time.sleep(0.1) try: connection = urlopen(req) print("\033[96m[\033[90m{0}\033[96m]".format(time.strftime("%H:%M:%S")),"\033[92mfound:","\033[0m/"+psx) found.append(url) except HTTPError as e: if e.code == 404: print("\033[96m[\033[90m{0}\033[96m]".format(time.strftime("%H:%M:%S")),"\033[91merror:","\033[0m/"+psx) else: print("\033[96m[\033[90m{0}\033[96m]".format(time.strftime("%H:%M:%S")),"\033[92minfo :","\033[33m/"+psx,"\033[92mstatus:\033[33m",resp_codes[e.code]) except URLError as e: sys.exit("\033[31m[!] Upss, No Internet Connection") except Exception as er: print("\n\033[93m[?] \033[0mYour Connection Is Bad") print("\033[93m[!] \033[0mExit Program") time.sleep(3) exit() except KeyboardInterrupt as e: print("\n\033[96m[?] \033[0mCTRL+C Detected") print("\033[96m[!] \033[0mExit Program") time.sleep(2) exit() if found: print("\n\033[96m[+] \033[0mResult Found\033[92m") print("\n".join(found)) print("\033[96m[?] \033[0mTime Elasped: \033[35m%.2f\033[0m Seconds" % float(time.time()-starttime)) else: print("\n\033[96m[!] \033[0mCould Not Find Any Shell Backdoor") print("\033[96m[?] \033[0mTime Elasped: \033[33m%.2f\033[0m Seconds" % float(time.time()-starttime)) def banner(): # just the screen display like this info = """\033[33m ___ .' '. : : | _ _ | .-.|(\033[91m0\033[93m)_(\033[91m0\033[93m)|.-. ( ( | .--. | ) ) '-/ ( ) \-' / '--' \\ \ `\033[91m"===="\033[93m` / '\ /' '\ /' _/'-.-'\_ _..:;\._/v\_./:;.._ .'/;:;:;\ /^\ /;:;:;\\'. / /;:;:;:;\| |/:;:;:;:\ \\ / /;:;:;:;:;\_/:;:;:;:;:\ \\ \033[91m # ================================== # # Shell Scanner # # Code by PosiX #\033[0m # Twitter: @posiX # # http://maqlo-heker.blogspot.com # # ================================== # """ return info print(banner()) if __name__ == '__main__': ZeroScann()

Very simple C++ library for parse arguments, in Python's argparse style.

import hashlib import argparse import time start_time = time.time() def check_password(hash, password): if(hashlib.sha256(password).hexdigest().upper()==hash.upper()): print("PASSWORD CRACKED : "+password) elapsed_time = time.time() - start_time print("Time to crack : "+str(elapsed_time)+" seconds.") quit() def count_print(i): i=i+1 if(i%1000000==0): print("Tried "+str(i)+" possibilities.") return i ### BEGIN BRUTE FORCE ATTACK chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" def bruteforce_length(hash, init_password, target_length, current_length, i): if(current_length==target_length): i = count_print(i) check_password(hash, init_password) else: for c in chars: i = bruteforce_length(hash, init_password+c, target_length, current_length+1, i) return i def bruteforce_attack(hash, max_length): i=0 for l in range(1,max_length+1): i = bruteforce_length(hash, "", l, 0, i) ### END BRUTE FORCE ATTACK ### BEGIN SIMPLE DICTIONARY ATTACK def dictionary_attack(hash, dict_filename): i=0 with open(dict_filename) as f: for line in f: i = count_print(i) password = line.rstrip() check_password(hash, password) ### END SIMPLE DICTIONARY ATTACK ### BEGIN DICTIONARY ATTACK WITH REPLACEMENTS def get_transformations(password, replacements, from_index): if(from_index==len(replacements)): return [password] else: res = [] nexts = get_transformations(password, replacements, from_index+1) repl = replacements[from_index] for t in nexts: res.append(t) transformation = t.replace(repl[0], repl[1]) if(transformation!=t): res.append(transformation) return res def dict_attack_with_replacements(hash, dict_filename, replacements): i=0 with open(dict_filename) as f: for line in f: i = count_print(i) password = line.rstrip() transformations = get_transformations(password, replacements, 0) for t in transformations: check_password(hash, t) ### END DICTIONARY ATTACK WITH REPLACEMENTS ### BEGIN TARGETED ATTACK def generate_possibilities(combination, words): result = [combination] for w in words: without = set(words) without.remove(w) new_combination = list(combination) new_combination.append(w) result.extend(generate_possibilities(new_combination, without)) return result def targeted_attack(hash, words): possibilities = map(lambda l: "".join(l), generate_possibilities([], words)) i=0 for p in possibilities: i = count_print(i) check_password(hash, p) ### END TARGETED ATTACK parser = argparse.ArgumentParser(description="Simple password cracker. "+ "Only a proof-of-concept for educational purposes. "+ " See github.com/mthambipillai/password-cracker for the full code and documentation.") parser.add_argument("hash", help="SHA256 hash of the password to crack.") parser.add_argument("method", help="Cracking method to use. Possible values are : brute_force, dict, dict_repl, targeted. ") parser.add_argument("-l", "--length_max", type=int, default=5, help="Maximum password length in 'brute_force' method. Default is 5.") parser.add_argument("-d", "--dictionary", default="", help="File name of the dictionary to use in 'dict' or 'dict_repl' methods.") parser.add_argument("-w", "--words", default="", help="List of words separated by commas. To be used as input to the 'targeted' method.") parser.add_argument("-r", "--replacements", default="", help="List of replacements separated by commas. To be used as input to the 'dict_repl' method. "+ "Each replacement of a char 'o' by a char 'n' must be written 'o/n'.") args = parser.parse_args() if(args.method=="brute_force"): bruteforce_attack(args.hash, args.length_max) elif(args.method=="dict"): if(args.dictionary==""): print("Method 'dict' requires argument 'dictionary'") quit() dictionary_attack(args.hash, args.dictionary) elif(args.method=="dict_repl"): if(args.dictionary==""): print("Method 'dict_repl' requires argument 'dictionary'") quit() if(args.replacements==""): print("Method 'dict_repl' requires argument 'replacements'") quit() replacements = map(lambda r: r.split("/"), args.replacements.split(",")) dict_attack_with_replacements(args.hash, args.dictionary, replacements) elif(args.method=="targeted"): if(args.words==""): print("Method 'targeted' requires argument 'words'") quit() words_set = set(args.words.split(",")) targeted_attack(args.hash, words_set) else: print("Cracking method '"+args.method+"' doesn't exist.") quit() print("Failed to crack the password with this method and these parameters.")